Since 69382d8b (qdev: Fix object reference leak in case device.realize()
fails), object_property_set_bool releases the device object
in case realize's failed and device hasn't explicitly assigned
parent. It happens due to object_unparent() on error handling
path releases not only implicitly set parent but also calls
device_unparent() which releases the remaining reference hold
buy parent bus.
qdev_try_create() created device has only 1 reference hold by
parent bus which makes impossible to unparent/re-parent object
without destroying it.
Fix it by making caller of qdev_try_create()/qdev_init_nofail()
own a reference from object_new() until qdev_init_nofail() is
successfully executed so that uparenting won't destroy device
until caller owns pointer returned by qdev_try_create().
Signed-off-by: Igor Mammedov <imamm...@redhat.com>
---
hw/core/qdev.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/hw/core/qdev.c b/hw/core/qdev.c
index ee4a083..0139d67 100644
--- a/hw/core/qdev.c
+++ b/hw/core/qdev.c
@@ -151,7 +151,6 @@ DeviceState *qdev_try_create(BusState *bus, const char
*type)
}
qdev_set_parent_bus(dev, bus);
- object_unref(OBJECT(dev));
return dev;
}
@@ -360,6 +359,7 @@ void qdev_init_nofail(DeviceState *dev)
object_get_typename(OBJECT(dev)));
exit(1);
}
+ object_unref(OBJECT(dev));
}
void qdev_machine_creation_done(void)
--
2.7.4
